Millions of current and former California public school students had their personal data, including names, dates of birth, addresses, and test records, stolen in a data breach involving the Educational Testing Service, the Los Angeles Times reported.
Compromised Login Credentials and Months of Unauthorized Access
The security incident originated from a compromised login credential that allowed an unauthorized party to access systems and copy files containing student information. According to information posted by the California Department of Education, this unauthorized data extraction occurred at various times between May 22 and September 18, 2026. Educational Testing Service discovered the breach on September 25, 2026. While state officials released public notification on a Friday, school district leaders had received word earlier on October 2, 2026.
The stolen records extend far beyond the state’s current enrollment of 5.7 million public school students. Because the dataset dates back to 2023 enrollments—and includes students who left California without confirming a transfer, going as far back as 2006—millions of adult former students are also affected. The exposed fields include student demographic information, grade level, unique student identifier numbers, gender, race or ethnicity, primary language, country of origin, and English learner status. Additionally, hackers accessed data regarding student disabilities and eligibility for federal low-income assistance programs. Officials confirmed that Social Security numbers, driver’s licenses, financial accounts, passwords, and parent or guardian personal information were not exposed.
The Statewide Impact and Expert Security Assessment
Educational Testing Service is a nonprofit organization that provides extensive services to California, maintaining student demographic, test participation, and assessment data tied to mandated annual standardized tests such as the Smarter Balanced assessments.
A stolen login credential should not become a months-long passport to millions of students’ personal records,
said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute, as reported by the Los Angeles Times. If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity.
Dahbura emphasized that outsourcing storage and processing does not transfer accountability. When millions of records concentrate with a single vendor, a single security failure scales into a statewide crisis affecting children for years.
Remediation Steps and Ongoing Uncertainty
In response to the incident, Educational Testing Service implemented additional safeguards, according to organization spokesperson Christine Betaneli. These measures include strengthened access controls, enhanced system monitoring, and more third-party reviews of security practices. Betaneli stated that no other ETS customers were affected by the breach.
Affected adults are eligible for 24 months of free identity-protection services and identity-restoration help. State officials also advised parents and guardians of children under 16 to consider requesting a free credit freeze to prevent unauthorized account creation. State education officials, working alongside a team of state agencies, continue to investigate the full scope and impact of the incident. While officials have found no evidence that the stolen data has been made public, uncertainty remains regarding whether a ransom demand was made or if the files are currently being held confidentially by the attackers.
